# Ransomware Readiness and the Role of Internal Audit

An episode of [All Things Internal Audit](https://invisiblenetwork.ai/podcast/1758983201), 28 Apr 2026, 22 min.

Audio: https://traffic.libsyn.com/secure/1984d534-f92f-4772-a722-6ac47400e67e/ATIA_-_Adam_Ross_and_Vipul_Patel_V3.mp3?dest-id=3677289

The Institute of Internal Auditors Presents: All Things Internal Audit Tech In this episode, Adam Ross speaks with Vipul Patel about how organizations can better prepare for ransomware attacks. They talk through what goes wrong in the first hours of an attack, what smart preparation looks like, and where traditional audit approaches fall short when a business is in crisis mode. • HOST: • Adam Ross, CIA, CISA Partner and Internal Audit Services Leader, Grant Thornton • GUEST: • Vipul Patel, CISA Audit and Assurance Managing Director, IT Internal Audit Leader, Deloitte & Touche LLP KEY POINTS: • Introduction \[00:00:02-00:00:27\] • Common Mistakes in Ransomware Response \[00:00:27-00:02:14\] • Building Crisis Communication Plans \[00:02:20-00:03:03\] • A Simple Incident Response Runbook \[00:03:03-00:05:03\] • Internal Audit's Role Before an Incident \[00:05:03-00:07:05\] • Stress Testing and "What If" Scenarios \[00:07:05-00:08:01\] • Tabletop Exercises and Cross-Functional Readiness \[00:08:02-00:10:03\] • Partnering With the CISO and Management \[00:10:03-00:11:15\] • Lessons Learned After Ransomware Incidents \[00:11:15-00:14:05\] • Governance Changes After an Attack \[00:14:55-00:16:55\] • Cyber Risk as a Business Issue \[00:16:55-00:17:16\] • Traits of Organizations That Respond Well \[00:17:20-00:19:44\] • Final Advice for Internal Auditors \[00:19:44-00:20:56\] Visit The IIA's website or YouTube channel for related topics and more. IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources: • Global Internal Audit Standards • Cybersecurity Topical Requirement • Course: Detecting, Mitigating and Responding to Global Ransomware Attacks • Articles: A Ransomware Playbook • IIA Certificates: IT General Controls Certificate • Knowledge Centers: Artificial Intelligence • Vison 2035 • IIA Courses: Fundamentals of IT Auditing • Become a Certified Internal Auditor (CIA) • CIA Challenge Exam Follow All Things Internal Audit: • Apple Podcasts • Spotify • Libsyn • Deezer

## Transcript

[0:02] The Institute of Internal Auditors presents All Things Internal Audit Tech.
[0:06] In this episode, Adam Ross speaks with Vipul Patel about
[0:10] how organizations can better prepare for ransomware attacks.
[0:14] They talk through what goes wrong in the first hours of an attack, what smart
[0:18] preparation looks like, and where traditional audit approaches fall short
[0:22] when a business is in crisis mode.
[0:27] What are the most common mistakes companies can make in the first hours or days
[0:31] when responding to a ransomware attack?
[0:33] I look at it in about two key points when we think
[0:36] about the common pitfalls or mistakes upon a response.
[0:41] One is probably the most biggest, and it happens more
[0:45] often than you think, Adam, is that organizations
[0:49] immediately start pulling the plug, pulling the cables.
[0:52] They start shutting their servers down because that's their
[0:55] impulse reaction, right, to a ransomware attack is, "Hey, we have
[0:59] to triage by just closing all the doors." The challenge with
[1:03] that is if there's not a plan of action, that
[1:07] instinct can cause a little bit of chaos with respect to the
[1:11] triaging, right? And as you're trying to stop the
[1:15] bleeding, as you're trying to pull the plugs to
[1:17] contain, you realize that
[1:21] you have this oh crap moment where I haven't
[1:24] preserved the necessary data artifacts or
[1:28] points to then triage down the road, right?
[1:30] So you're almost making the investigation 10 times
[1:34] harder by acting on that impulse of pulling the cables.
[1:38] And I think that's probably one of the biggest pitfalls.
[1:41] The second piece of it
[1:43] is what I call communication chaos.
[1:46] Again, without a well-articulated plan, you
[1:50] have the legal team talking to IT.
[1:54] You have the CEO calling the CISO. Nobody knows who's in
[1:57] charge, and while everybody's just calling each other, there's
[2:01] actually no work being done to triage that ransomware
[2:05] attack. So I think the organizations that tend to respond
[2:09] well have a clear communication protocol and a clear
[2:13] ownership model. But yeah, I'd say those are probably the two
[2:17] biggest things from my experience that I've sort of seen out in the market.
[2:20] That's very interesting. On the communication side, I'm curious in terms of
[2:24] your thoughts when companies have incident response plans, do you think that
[2:28] it's beneficial for them to have specific communication plans
[2:32] relevant to a given crisis or incident or does it
[2:35] typically fall under is it sufficient if it's the overall communication plan
[2:39] that could be applicable to multiple different situations?
[2:42] Yeah, I think that's a great question.
[2:44] The ones that do it well that I've seen almost have just
[2:47] overarching crisis management, right?
[2:50] And there's sort of a communications plan associated with any
[2:53] crises, right, cyber attacks being one of them,
[2:57] but disaster recovery, whatever it might be, there is an
[3:01] overarching plan, to your point.
[3:03] You laid out some common mistakes.
[3:06] Can you maybe walk us through a real-world scenario or example
[3:10] where the company's response to a ransomware attack,
[3:14] let's say positive, went well?
[3:16] I guess relatively speaking went well.
[3:17] There's been a ransomware attack, which is not great, but maybe you can share a
[3:20] little bit about how in a real-world scenario that they were thoughtful in their
[3:24] response to minimize the impact.
[3:26] Yeah. No, that's a great question.
[3:27] Of course, I can't name specific organization
[3:31] names, so I'll try to keep it general, but still directionally valid.
[3:36] There was this one organization that I worked with,
[3:39] and as I was interacting with the
[3:43] executive team,
[3:45] and again, this was post-incident, and we were sort of doing a reflection.
[3:50] And I posed various questions, and I
[3:53] actually had a chance to go visit the server
[3:56] room. And I kid you not, I walked
[3:59] in, and on the inside of the server room, there was
[4:03] a laminated one-pager that's just taped to the wall,
[4:07] and literally just a printed run book per se,
[4:11] of how to react upon an
[4:15] incident.
[4:17] And it said, "Stop, isolate, document,
[4:21] and then call these three numbers." And just a
[4:25] simple plan like that, that again,
[4:28] reduces the impulse reaction, was just so well
[4:32] done. As we all know, human nature, right, when
[4:36] our heartbeats are elevated, and we're under this sort of pressure,
[4:40] fear, complexity is the worst thing to have, right?
[4:44] So I think that particular organization did it very, very well to just have
[4:48] just a simple laminated one-pager that calls out
[4:51] the steps and the right people to call.
[4:54] That makes a lot of sense. The stop, look, listen approach as opposed to the
[4:58] three-ring binder with reams of paper
[5:01] certainly can be a little overwhelming.
[5:04] You've kind of teased the next question as we start to talk about the role of
[5:07] internal audit. I'm assuming that you were having those conversations in a
[5:11] capacity as an internal auditor. So maybe you can talk a little bit about
[5:15] before a ransomware incident even occurs, where do you see internal audit
[5:19] adding the most value in helping organizations prepare?
[5:22] Another great question, and hugely relevant, again, for our audience.
[5:26] Internal audit sits in a really unique position within an
[5:30] organization. They really have visibility and access
[5:34] across the enterprise that, quite frankly, most functions
[5:37] don't have that access. So the question is, what can
[5:41] internal auditors do with that access?
[5:44] And I think it starts with asking
[5:48] those uncomfortable questions, especially
[5:51] to the groups that are closest to the
[5:55] protocols and processes, almost as a gut check, right?
[5:59] Because, again, the ones that are closest to it may not have
[6:03] that purview. And so even if it's asking
[6:06] questions around the IR planIs it
[6:10] documented a certain way? Asking questions about the
[6:14] organizational structure, is it set up the right way to react?
[6:18] And what we're seeing specifically on the IR plans is,
[6:22] nowadays, companies are restructuring,
[6:26] reorging quite often as they evolve their business model.
[6:30] Sometimes those things aren't reflected in IR plans, and it's left for assumption.
[6:34] So I think that's where internal audit can use the access they
[6:38] have to ask the tough questions, asking around testing backups.
[6:42] That's at the surface probably the
[6:46] easiest question to ask, but it's not really about testing the backup
[6:50] per se, it's how are they able to restore the backup, because that's the most
[6:54] critical part of incident. So I think that's probably the
[6:58] best. Things look good on paper, but having internal
[7:02] audit stress test it is probably the key value driver there.
[7:05] I think that stress testing approach is a really important one.
[7:09] We're on the outside. We're not beholden or necessarily the
[7:12] owner of the plans and the processes, so we have the opportunity
[7:16] to ask questions. I encourage teams to channel their inner Dennis the Menace in
[7:20] those situations.
[7:21] How would you create a scenario where something could break, whether that be
[7:25] something as simple as, we were doing an audit of texting for
[7:29] a health system. They said they used it to confirm appointments, one to
[7:33] confirm, nine to change. We said, "You're dealing with older
[7:36] patients. What's to stop them from responding with their Social Security number?
[7:40] And what do you do if they do that? Are you going to make sure that you dispose of
[7:43] that?" And they're like, "Why would someone respond with their Social Security
[7:46] number?" And I said, "I don't know, but is it possible?
[7:48] It is." And I think that's the great role internal audit could be bringing to
[7:52] these, is to help management think through some of those scenarios that maybe
[7:55] they're a little too close to, to come up with.
[7:58] Right, those what if scenarios.
[7:59] Yeah.
[8:00] Right. Absolutely.
[8:01] Yeah. Fantastic. Do you have any specific examples or use cases
[8:05] where internal audit helped strengthen ransomware readiness?
[8:07] And maybe it could be developing or participating in tabletop
[8:11] exercises, testing some of those controls you mentioned, or even
[8:14] evaluating the efficacy or sufficiency of those incident response plans.
[8:19] Absolutely. I think all three for sure.
[8:22] What I'm seeing in the market, again, depending on the maturity of
[8:26] internal audit functions, you certainly have testing or any
[8:30] kind of assurance around existing controls.
[8:33] But I think what I've seen the most
[8:36] impactful is really the tabletops.
[8:38] That's when you sort of get some immediate aha moments,
[8:43] especially not just as your role as an internal audit
[8:46] function, but when you are involved in helping
[8:50] bring all the other functions to the table.
[8:52] You have your CISO organization, you have legal,
[8:56] you've got your comms groups, you've got ops folks.
[9:01] And when you can get everybody in a room together
[9:04] and you work through scenarios, it's just so
[9:08] telling what you uncover within the first half
[9:12] hour, hour. Where you realize that
[9:16] legal didn't know that IT
[9:20] can read or have access to encrypted files.
[9:24] You have awareness that the CFO,
[9:28] if the organization chooses to make the ransom payment,
[9:32] that you may need to abide by OFAC rules
[9:36] to prevent any kind of sanction law violation.
[9:39] So these are the nuanced details that, again,
[9:43] if you're not doing a tabletop and you're bringing all the parties together,
[9:47] you don't want to realize this stuff during an incident.
[9:50] That's that, oh crap moment. So I see just a
[9:54] tremendous amount of value with internal audit having a seat and
[9:58] almost facilitating this is where I would
[10:02] say the biggest thing is.
[10:03] I would think the vast majority of our listeners and internal auditors in general
[10:06] would agree. I do have a follow-up question, though. It does take two to tango.
[10:10] Management has to be open to internal audit participating, and maybe you can
[10:14] share to those listening some-
[10:16] Absolutely. I think budgets help.
[10:21] Many times, IT organizations who
[10:24] traditionally have been sort of the ones that spearhead these kind of
[10:28] tabletop activities, that they have limited resources.
[10:31] And so if audit functions have the budget,
[10:35] that's where a sense of partnership can come into play.
[10:38] But even just sort of elevating this to the board level.
[10:42] And that's the one group of folks that internal audit,
[10:46] with the audit committee, has access to.
[10:48] And you sort of partner with the ITO to raise the awareness
[10:52] of the importance of doing this, the resources will come.
[10:55] And I've said this word a couple of times around partnership.
[10:59] That's probably the biggest thing for internal auditors.
[11:02] Just go find your CISO,
[11:04] make friends with them, or at least in a business realm, help articulate
[11:08] the value of IA and help articulate the impact and benefits of
[11:12] working together. It starts there with that relationship.
[11:15] Love it. So you've already shared several suggestions on ways
[11:19] organizations can more proactively approach ransomware
[11:23] preparedness and how internal audit can support that.
[11:26] Maybe you can share some lessons learned from your experiences when
[11:30] the dust settles, when organizations kind of take a breath and really do a root
[11:34] cause and come up with, how can we get better?
[11:37] How can our listening audience learn from others'
[11:40] experiences?
[11:42] Yeah. And that's really what it's about too.
[11:44] I think we all have to have that learning mindset.
[11:47] I think back, cyber has been such a heavy topic
[11:51] and top-of-mind topic for over a decade now.
[11:54] And you sort of shifted the approach to cyber
[11:58] across that journey from, hey, let's not get attacked,
[12:02] but then it shifted quickly to a, it's going to happen.
[12:07] You're going to get attacked in some capacity.
[12:10] So how do you contain it? How do you respond to it, recover from it?
[12:14] And so the knowledge sharing across the board, II value
[12:17] that. I think it should happen more, but I understand the sensitivity of the nature
[12:21] of sharing. So I would say based on my experience
[12:25] and what I've seen out in the market, there's probably three
[12:29] pretty important lessons learned.
[12:31] Number one is, many organizations sort of hang their hat
[12:35] on, we have a plan, we have a plan, we have a plan.
[12:39] The challenge was that they just didn't practice it enough.
[12:43] And I think building that muscle memory to
[12:47] practice the plan, do the tabletop exercises, upon an incident,
[12:51] you sort of become second nature. I would say the second big one,
[12:55] and some we're seeing pretty prevalent over the past five years or so, is
[12:59] third-party exposure. Many times, organizations, they get
[13:03] surprised that the entry point into their
[13:06] environment is actually through a vendor or a
[13:10] contractor or a SaaS software tool.
[13:13] And so just getting some arms around that piece of it is
[13:18] super important. And the third one is a little bit nuanced, but I would
[13:21] say is more cultural. Many times organizations
[13:25] create these programs where they'll do like phishing
[13:29] just to test the people side of the house.
[13:32] And
[13:33] I think there's like this fear factor, per se, where
[13:37] people are afraid to raise their hand if they notice something wonky,
[13:41] and they just assume, oh, IT's probably got this handled. Right?
[13:44] And if there could be a way to change that culture where it's safe to raise your
[13:48] hand, safe to point out something that may feel a little
[13:52] off without fear of anything, I think that's probably a
[13:56] third biggest, and that's where internal audit can really come into play to sort
[14:00] of champion that kind of culture. But I'd say those are probably the
[14:04] three big ones.
[14:05] Those are super interesting, and they make a lot of sense.
[14:07] The first one I heard is the practice helps make it predictable and repeatable,
[14:11] so the organization has a reduced risk of failure when they need to execute the
[14:15] plan. Because otherwise, to put my accounting hat on, it's a
[14:19] significant and unusual transaction, and they might not be used to executing the
[14:23] controls related to it. So the more they do it, the more comfortable they'll be,
[14:26] and they're more likely to execute as the plan.
[14:29] The other thing that really stood out to me is the encouraging
[14:33] a culture of see something, say something, and make it easy for
[14:37] individuals to raise their hands, whether it be write in your
[14:41] email, report phish, and just let it go.
[14:44] And if it's nothing, it's nothing, but you should never be afraid
[14:48] to raise your hand and call Chicken Little, because it very well may be
[14:52] something. So those are great things.
[14:55] A little bit of a follow-up question on this, are there any specific changes you've
[14:59] observed either to governance or control as a
[15:03] result of an attack or a debrief on a
[15:06] ransomware attack? I'm curious if maybe you could share some of those examples.
[15:10] I think I mentioned this a little bit earlier.
[15:13] We talked about the view of
[15:17] governance and the ownership, and I touched on sort
[15:21] of crisis as a whole overarching, which could be cyber,
[15:25] any other ransomware, other disaster recovery, et cetera.
[15:28] There is one particular example of an organization.
[15:30] I thought this was brilliant, by the way, is they did have a significant
[15:34] incident, and after the dust settled and
[15:38] the organization reflected on sort of what went well, what didn't work
[15:42] well, they actually took it upon themselves to restructure
[15:46] their overarching crisis governance model.
[15:49] And what was happening before is
[15:52] they had their incident response plan have
[15:56] IT as the de facto lead.
[15:59] As most organizations do. But what they did is they
[16:03] realized, hey, ransomware is
[16:06] actually a business crisis. It's not a
[16:10] technology crisis, even though the entry point was through
[16:13] technology, the impact of it is broader than just IT.
[16:18] And so when they made that change, it really elevated the response
[16:21] structure. It elevated the accountability of it to have a
[16:25] business executive as that sort of incident coordinator or commander.
[16:29] Other functions were still there.
[16:31] IT, legal, everybody still had an equal part, equal seat at the table.
[16:34] But just changing that ownership I thought was actually a brilliant
[16:38] move, and again, it shifted the conversation from tech, tech,
[16:42] tech to just sort of enterprise.
[16:44] Again, haven't touched base with that organization again, but I'd
[16:48] imagine a shift in that governance model will probably
[16:52] allow them to respond quicker in the future.
[16:55] And I think that's consistent with what our profession has been saying for a long
[16:58] time, which is this is a subset of a cyber risk issue.
[17:02] And we've always said all along that cyber risk is a business issue.
[17:06] It's not an IT-only issue. That's why we spend so much time trying to
[17:09] educate the employee base and the workforce on their role in protecting the
[17:13] information assets. And like you said, keeping their eyes open.
[17:15] Absolutely.
[17:16] So we've covered an awful lot of ground in a quick amount of time here.
[17:20] Curious if you have any examples of organizations doing this
[17:23] particularly well that internal auditors can learn from.
[17:26] I know you talked a lot about participating in tabletops, being proactive, and
[17:30] working with management. Are there any other suggestions you have for internal
[17:33] auditors that they could benefit from?
[17:36] Absolutely. I think without being able to name specific
[17:39] organizations, if I think through the
[17:43] organizations that do this well, they share
[17:47] a few common traits, and I think that might be helpful for the audience to
[17:51] understand what are those traits.
[17:53] One, as I said earlier, they're treating cyber resilience as
[17:57] sort of a board-level conversation.
[17:59] Again, not an IT conversation. It's getting the whole entire organization
[18:03] involved and aware of that. And I think companies are
[18:06] seeing that. It's not just a recent, I would say over the past decade or so,
[18:10] you always see cyber popping up at least on a quarterly basis
[18:14] on board agendas.
[18:16] And going back to that building that muscle memory.
[18:19] Just keep running the drills, keep running the drills, keep running the drills.
[18:23] You do it so frequently that at the time of an incident, when it really happens,
[18:26] it's just second nature, and people fall into the roles, they execute, and
[18:31] it goes without a hitch. The other piece of it too, and I think, again,
[18:35] probably refreshing for our audience to hear is, again, those organizations
[18:39] that do this well, they're actually embedding internal audit
[18:43] into the resilience framework.Right?
[18:46] So traditionally you sort of see, hey, internal audit come in after the fact.
[18:50] Hey, what went well? What didn't go well?
[18:52] Help identify the findings that someone else can go fix it.
[18:55] But if you're embedding internal audit into the
[18:59] resilience framework and you're treating internal audit as
[19:03] sort of a proactive testing partner,
[19:05] I think that really helps, one,
[19:08] build more robust, effective IR plan,
[19:13] but also again, improve the brand of internal audit, the
[19:16] partnership, et cetera. I would say financial services
[19:20] firms and any other organizations that have critical
[19:24] infrastructure to them, those are ones that are doing this really, really well,
[19:27] mostly because they've got the regulatory pressure to do so, and probably the
[19:31] resources, dollars, et cetera. But I would say just again,
[19:35] those key pieces or traits that I've seen across the board,
[19:39] if organizations could sort of follow those, I think that's just that mindset that
[19:43] is ingrained in that.
[19:44] Well, I think you're certainly saying the right things as far as I'm concerned, and
[19:48] it's definitely aligned with the IIA's Vision 2035, where internal audit
[19:52] continues to evolve into more of a strategic risk advisor and business partner
[19:55] while still maintaining its objectivity and independence.
[19:58] This has been a great conversation, and before we wrap up, I just wanted to see if
[20:01] you had any other sage words of advice for our listening audience in terms of
[20:05] ways internal audit can help, or other considerations they should be
[20:09] thinking about in this important area.
[20:11] I think if our professionals can just continue to
[20:15] keep in mind that, again, this is not just a technology issue.
[20:19] Yes, technology matters, backup, segmentation, MFA, that's all
[20:23] good stuff. But we all need to remember that the critical failure point
[20:27] most likely is going to be the people, right?
[20:30] And ownership, untested plans,
[20:34] siloed communication, these are really the critical pieces
[20:38] of sort of cyber breaches. And if internal auditors can have a
[20:42] seat at the table and deeply look at and be
[20:46] involved in the development of those three things, I think it'll just go a
[20:50] very, very long way for moving the needle.
[20:52] Excellent. Well, thank you so much for your time and your very thoughtful insights.
[20:55] Greatly appreciated.
[20:56] Thank you, Adam, for having me.
[20:58] Earning the CIA usually means three separate exams, but
[21:02] it doesn't have to. The CIA Challenge exam is designed for
[21:06] experienced professionals who already hold a CPA, CISA,
[21:10] CISA, or have a background in internal audit.
[21:14] You qualify through one of three pathways, including a pilot
[21:17] option for people with 10 plus years of experience.
[21:20] That pilot closes September 30th, 2026, so
[21:24] don't sleep on it. Becker study materials can help you prepare for this
[21:27] exam, and if you're interested, you can find the link to the challenge exam in the
[21:31] show notes.
[21:33] If you like this podcast, please subscribe and rate us.
[21:36] You can subscribe wherever you get your podcasts.
[21:39] You can also catch other episodes on YouTube or at the iia.org.
[21:43] That's T-H-E-I-I-A.O-R-G.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.